Google Professional Cloud DevOps Engineer Question 79
Select 3Google Cloud PlatformYour team is building a cloud-based e-commerce platform that processes sensitive customer payment information. To ensure encryption and secure key management, you decide to use Google Cloud Key Management Service (KMS). During a security audit, the auditor raises concerns about key rotation and access control for the encryption keys. What steps should you take to address these concerns?
- A
Set up automatic key rotation for the keys used in Google Cloud KMS.
- B
Grant the 'Owner' role to all engineers to ensure they can manage the keys if needed.
- C
Define IAM policies to follow the principle of least privilege for key access.
- D
Manually rotate the keys every month by disabling the old key version and enabling a new key version.
- E
Enable logging in Cloud Audit Logs to monitor access to the keys.
Show answer and explanation
Correct answers: A, C, E
Explanation
To address the auditor's concerns, you need to ensure that key rotation and access control are handled securely. Automatic key rotation in Google Cloud KMS ensures that keys are updated regularly without manual errors. IAM policies should enforce the principle of least privilege to restrict access to sensitive information. Enabling logging with Cloud Audit Logs provides visibility into key usage and access, which is critical for detecting and responding to security incidents. Avoid granting excessive permissions or relying on manual processes that are prone to human error.
- A. Correct.
Enabling automatic key rotation ensures that keys are rotated regularly without manual intervention, improving security.
- B. Incorrect.
Granting the 'Owner' role to all engineers violates the principle of least privilege and exposes the keys to unnecessary risk.
- C. Correct.
Defining IAM policies with the principle of least privilege minimizes the risk of unauthorized access to the encryption keys.
- D. Incorrect.
Manually rotating keys every month is error-prone and inefficient. Automatic key rotation is the preferred method in Google Cloud KMS.
- E. Correct.
Enabling logging in Cloud Audit Logs allows you to monitor and audit access to the keys, which is essential for maintaining security and compliance.